We answer this question and analyze the tightness of the
DP-SGD analysis under various assumptions by instantiating the adversary against the differentially private training algorithm.
This gives us a lower bounds on the privacy leakage that may result.
Our primary goal is to not only investigate the tightness of DP-SGD under any one particular set of assumptions [1]}, but also to understand the relative importance of adversary capabilities assumed to establish this upper bound.
This allows us to appreciate what practical conditions need to be met before an adversary exploits the full extent of the privacy leakage tolerated by the upper bound.
This section develops our core algorithm: adversary instantiation.
We begin with our motivations to construct this adversary (§ REF )
present the algorithm (§ REF ) and then
describe how to use this algorithm to lower bound privacy (§ REF ).
<FIGURE>